Patchwork bridge: Fix IGMP3 report parsing

login
register
mail settings
Submitter Herbert Xu
Date April 8, 2010, 1:26 a.m.
Message ID <20100408012634.GC18649@gondor.apana.org.au>
Download mbox | patch
Permalink /patch/49681/
State Changes Requested
Delegated to: David Miller
Headers show

Comments

Herbert Xu - April 8, 2010, 1:26 a.m.
Hi:

bridge: Fix IGMP3 report parsing

The IGMP3 report parsing is looking at the wrong address for
group records.  This patch fixes it.

Reported-by: Banyeer <banyeer@yahoo.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>


Thanks,
David Miller - April 8, 2010, 3:52 a.m.
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Thu, 8 Apr 2010 09:26:34 +0800

> Hi:
> 
> bridge: Fix IGMP3 report parsing
> 
> The IGMP3 report parsing is looking at the wrong address for
> group records.  This patch fixes it.
> 
> Reported-by: Banyeer <banyeer@yahoo.com>
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

I think you're adding as many bugs as you are fixing here :-)

> @@ -719,11 +719,11 @@ static int br_multicast_igmp3_report(struct net_bridge *br,
>  	len = sizeof(*ih);
>  
>  	for (i = 0; i < num; i++) {
> +		grec = (void *)(skb->data + len);
>  		len += sizeof(*grec);
>  		if (!pskb_may_pull(skb, len))
>  			return -EINVAL;
>  
> -		grec = (void *)(skb->data + len);
>  		group = grec->grec_mca;
>  		type = grec->grec_type;
>  

If pskb_may_pull() actually does anything non-trivial,
skb->data will change and you'll be referring to freed
up memory.

That's probably why you had the grec assignment where
you originally had it in the first place :-)
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 6980625..5f0acfd 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -719,11 +719,11 @@  static int br_multicast_igmp3_report(struct net_bridge *br,
 	len = sizeof(*ih);
 
 	for (i = 0; i < num; i++) {
+		grec = (void *)(skb->data + len);
 		len += sizeof(*grec);
 		if (!pskb_may_pull(skb, len))
 			return -EINVAL;
 
-		grec = (void *)(skb->data + len);
 		group = grec->grec_mca;
 		type = grec->grec_type;